motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2026-02-11 19:39:26 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions
qemu/include/hw/i386
History
Philippe Mathieu-Daudé 4177b062fc hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ 
libFuzzer triggered the following assertion:

  cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
    -nographic -monitor none -serial none \
    -qtest stdio -d guest_errors -trace pci\*
  outl 0xcf8 0x8400f841
  outl 0xcfc 0xebed205d
  outl 0x5d02 0xedf82049
  EOF
  pci_cfg_write ICH9-LPC 31:0 @0x41 <- 0xebed205d
  hw/pci/pci.c:268: int pci_bus_get_irq_level(PCIBus *, int): Assertion `irq_num < bus->nirq' failed.

This is because ich9_lpc_sci_irq() returns -1 for reserved
(illegal) values, but ich9_lpc_pmbase_sci_update() considers
it valid and store it in a 8-bit unsigned type. Then the 255
value is used as GSI IRQ, resulting in a PIRQ value of 247,
more than ICH9_LPC_NB_PIRQS (8).

Fix by simply ignoring the invalid access (and reporting it):

  pci_cfg_write ICH9-LPC 31:0 @0x41 <- 0xebed205d
  ICH9 LPC: SCI IRQ SEL #3 is reserved
  pci_cfg_read mch 00:0 @0x0 -> 0x8086
  pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
  ...

Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: 8f242cb724 ("ich9: implement SCI_IRQ_SEL register")
BugLink: https://bugs.launchpad.net/qemu/+bug/1878642
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20200717151705.18611-1-f4bug@amsat.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-11-03 09:42:53 -05:00
..
apic-msidef.h i386/msi: Correct mask of destination ID in MSI address 2017-12-01 18:28:15 +02:00
apic.h Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
apic_internal.h Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00
ich9.h hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ 2020-11-03 09:42:53 -05:00
intel_iommu.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
ioapic.h ioapic: use TYPE_FOO MACRO than constant string 2019-01-09 11:33:47 +01:00
ioapic_internal.h Use OBJECT_DECLARE_TYPE when possible 2020-09-18 14:12:32 -04:00
microvm.h microvm: add usb support 2020-10-21 11:36:19 +02:00
pc.h pc: Implement -no-hpet as sugar for -machine hpet=on 2020-10-30 04:29:13 -04:00
topology.h Revert "hw/i386: Update structures to save the number of nodes per package" 2020-09-02 07:29:26 -04:00
vmport.h hw/i386/vmport: Drop superfluous parenthesis around function typedef 2020-09-18 13:49:54 -04:00
x86-iommu.h Use OBJECT_DECLARE_TYPE when possible 2020-09-18 14:12:32 -04:00
x86.h pc: Implement -no-hpet as sugar for -machine hpet=on 2020-10-30 04:29:13 -04:00